php oath server suite
4.0.5
Uma coleção de classes para fornecer autenticação de segundo fator, como Yubico OTP (Yubikey), Oath (TOTP, HOTP, GoogleAuthenticator) no lado do servidor.
Para obter mais informações sobre o juramento, consulte https://openauthentication.org/.
Mais informações sobre TOTP (algoritmo de senha única baseado em tempo) podem ser encontradas na Wikipedia.
Mais informações sobre HOTP (algoritmo de senha única baseado em HMAC) podem ser encontradas na Wikipedia.
Para obter mais informações sobre o mecanismo de autenticação Yubico OTP, leia o artigo “O que é YubiKey OTP?” em https://developers.yubico.com/OTP/.
{
"require": {
"chroma-x/oath-server-suite": "~4.0"
}
}
require_once('path/to/vendor/autoload.php');
Para usar o Yubico OTP você precisa de acesso ao YubiCloud. Você pode obter credenciais de API gratuitas em https://upgrade.yubico.com/getapikey/.
use ChromaXCommonExceptionNetworkExceptionBaseNetworkException;
$otp = $_POST['otp'];
$userPublicId = 'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationYubicoOtpValidator('yubiCloudClientId', 'yubiCloudSecretKey');
try {
$validator->validate($otp, $userPublicId);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
} catch (NetworkException $exception) {
// Accessing the YubiCloud webservice failed.
}
Para permitir a autenticação, o cliente e o servidor devem compartilhar um segredo. Normalmente, o servidor separa um segredo e o exibe junto com o nome da chave e o mecanismo de autenticação como um código QR.
O Google Authenticator e alguns outros aplicativos e itens de hardware – como o Yubikey – não seguem o padrão, esperando que os segredos não sejam hexadecimais, mas como dados codificados em Base32.
use ChromaXOathServerSuiteSecretSharingSharedSecretQrCodeProviderSharedSecretQrCodeProvider;
use ChromaXOathServerSuiteSecretSharingSharedSecretUrlEncoderTotpBase32SharedSecretUrlEncoder;
use ChromaXQrCodeSuiteQrEncodeQrEncoder;
// Initialize Oath URL encoder for TOTP (Time-based One-time Password Algorithm)
$contentEncoder = new TotpBase32SharedSecretUrlEncoder();
// Setting the key name
$keyName = 'My Username';
// Setting the issuer name
$issuerName = 'Awesome Application';
// Setting a secret
// Attention: This is just an example value
// Use a random value of a proper length stored with your user credentials
$sharedSecret = openssl_random_pseudo_bytes(30);
// Getting the shared secret URL for usage wihtout QR code provision
$sharedSecretUrl = $contentEncoder->encode($keyName, $sharedSecret);
// Start QR code provision
// Initialize the QR code provider with Oath URL encoder for TOTP
$sharedSecretQrProvider = new SharedSecretQrCodeProvider(new TotpBase32SharedSecretUrlEncoder(), $keyName, $sharedSecret, $issuerName);
// Configure the QR code renderer for your needs
$sharedSecretQrProvider->getQrEncoder()
->setLevel(QrEncoder::QR_CODE_LEVEL_LOW)
->setTempDir('/path/to/a/writable/temp-dir');
// Persist the QR code PNG to the filesystem
$sharedSecretQrProvider->provideQrCode('/path/to/the/qrcode.png');
use ChromaXOathServerSuiteSecretSharingSharedSecretQrCodeProviderSharedSecretQrCodeProvider;
use ChromaXOathServerSuiteSecretSharingSharedSecretUrlEncoderHotpBase32SharedSecretUrlEncoder;
use ChromaXQrCodeSuiteQrEncodeQrEncoder;
// Initialize Oath URL encoder for HOTP (HMAC-based One-time Password Algorithm)
$contentEncoder = new HotpBase32SharedSecretUrlEncoder();
// Setting the key name
$keyName = 'My Username';
// Setting the issuer name
$issuerName = 'Awesome Application';
// Setting a secret
// Attention: This is just an example value
// Use a random value of a proper length stored with your user credentials
$sharedSecret = openssl_random_pseudo_bytes(30);
// Getting the shared secret URL for usage wihtout QR code provision
$sharedSecretUrl = $contentEncoder->encode($keyName, $sharedSecret);
// Start QR code provision
// Initialize the QR code provider with Oath URL encoder for HOTP
$sharedSecretQrProvider = new SharedSecretQrCodeProvider(new HotpBase32SharedSecretUrlEncoder(), $keyName, $sharedSecret, $issuerName);
// Configure the QR code renderer for your needs
$sharedSecretQrProvider->getQrEncoder()
->setLevel(QrEncoder::QR_CODE_LEVEL_LOW)
->setTempDir('/path/to/a/writable/temp-dir');
// Persist the QR code PNG to the filesystem
$sharedSecretQrProvider->provideQrCode('/path/to/the/qrcode.png');
$totp = $_POST['totp'];
$sharedSecret = 'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationOathTotpValidator();
$validator->validate($totp, $sharedSecret);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
$hotp = $_POST['hotp'];
$sharedSecret = 'fetchedFromDatabaseOrSimilar';
$counter = (int)'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationOathHotpValidator();
$validator->validate($hotp, $sharedSecret, $counter);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
use ChromaXOathServerSuiteSecretSharingSharedSecretQrCodeProviderSharedSecretQrCodeProvider;
use ChromaXOathServerSuiteSecretSharingSharedSecretUrlEncoderTotpSharedSecretUrlEncoder;
use ChromaXQrCodeSuiteQrEncodeQrEncoder;
// Initialize Oath URL encoder for TOTP (Time-based One-time Password Algorithm)
$contentEncoder = new TotpSharedSecretUrlEncoder();
// Setting the key name
$keyName = 'My Username';
// Setting the issuer name
$issuerName = 'Awesome Application';
// Setting a secret
// Attention: This is just an example value
// Use a random value of a proper length stored with your user credentials
$sharedSecret = openssl_random_pseudo_bytes(30);
// Getting the shared secret URL for usage wihtout QR code provision
$sharedSecretUrl = $contentEncoder->encode($keyName, $sharedSecret);
// Start QR code provision
// Initialize the QR code provider with Oath URL encoder for TOTP
$sharedSecretQrProvider = new SharedSecretQrCodeProvider(new TotpSharedSecretUrlEncoder(), $keyName, $sharedSecret, $issuerName);
// Configure the QR code renderer for your needs
$sharedSecretQrProvider->getQrEncoder()
->setLevel(QrEncoder::QR_CODE_LEVEL_LOW)
->setTempDir('/path/to/a/writable/temp-dir');
// Persist the QR code PNG to the filesystem
$sharedSecretQrProvider->provideQrCode('/path/to/the/qrcode.png');
use ChromaXOathServerSuiteSecretSharingSharedSecretQrCodeProviderSharedSecretQrCodeProvider;
use ChromaXOathServerSuiteSecretSharingSharedSecretUrlEncoderHotpSharedSecretUrlEncoder;
use ChromaXQrCodeSuiteQrEncodeQrEncoder;
// Initialize Oath URL encoder for HOTP (HMAC-based One-time Password Algorithm)
$contentEncoder = new HotpSharedSecretUrlEncoder();
// Setting the key name
$keyName = 'My Username';
// Setting the issuer name
$issuerName = 'Awesome Application';
// Setting a secret
// Attention: This is just an example value
// Use a random value of a proper length stored with your user credentials
$sharedSecret = openssl_random_pseudo_bytes(30);
// Getting the shared secret URL for usage wihtout QR code provision
$sharedSecretUrl = $contentEncoder->encode($keyName, $sharedSecret);
// Start QR code provision
// Initialize the QR code provider with Oath URL encoder for HOTP
$sharedSecretQrProvider = new SharedSecretQrCodeProvider(new HotpSharedSecretUrlEncoder(), $keyName, $sharedSecret, $issuerName);
// Configure the QR code renderer for your needs
$sharedSecretQrProvider->getQrEncoder()
->setLevel(QrEncoder::QR_CODE_LEVEL_LOW)
->setTempDir('/path/to/a/writable/temp-dir');
// Persist the QR code PNG to the filesystem
$sharedSecretQrProvider->provideQrCode('/path/to/the/qrcode.png');
$totp = $_POST['totp'];
$sharedSecret = 'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationOathTotpValidator();
$validator->validate($totp, $sharedSecret);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
$hotp = $_POST['hotp'];
$sharedSecret = 'fetchedFromDatabaseOrSimilar';
$counter = (int)'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationOathHotpValidator();
$validator->validate($hotp, $sharedSecret, $counter);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
php oath server suite fornece diferentes exceções – algumas fornecidas pelo projeto PHP Common Exceptions – para tratamento adequado.
Você pode encontrar mais informações sobre exceções comuns do PHP no Github.
Contribuir com nossos projetos é sempre muito apreciado.
Mas: siga as diretrizes de contribuição escritas no documento CONTRIBUTING.md.
php oath server suite está sob a licença do MIT.
